MICROSOFT phish running on florianocontabil[.]com[.]br

Found: 2018-05-28 13:17:46.626000
URL: http://florianocontabil.com.br/newhotmail.zip
File: florianocontabil.com.br-foo-newhotmail.zip
Domain: florianocontabil.com.br
Target: MICROSOFT
Name                                               Size Date                 MD5                                newhotmail/Validation/geoplugin.class.php           4647 2017-08-10 11:56:52  c8ea1e960b48a620c00bc65d525a721c
    File appears in 1313 kits  and under 3 different file names
newhotmail/Validation/images/01.png                14801 2017-08-10 11:56:56  03f4a3e68423c7c5c594e40223941141
    File appears in 15 kits
newhotmail/Validation/images/02.png                  787 2017-08-10 11:56:58  fac26b74bd13ca8ecd98875a37d155fa
    File appears in 18 kits
newhotmail/Validation/images/03.png                13837 2017-08-10 11:56:58  0f19fff07ee77a15e87b684b34e5262b
    File appears in 15 kits
newhotmail/Validation/images/04.png                  877 2017-08-10 11:56:58  f538109d65c084d5d56b5f33eee1aac4
    File appears in 18 kits
newhotmail/Validation/images/05.png                  750 2017-08-10 11:56:58  7e537437294b406eba29931f523d47ae
    File appears in 18 kits
newhotmail/Validation/index.php                      422 2017-08-10 11:56:52  9ef6af054f32761ce929ba0f4e771d92
    File appears in 17 kits
newhotmail/Validation/index.txt                       70 2017-08-10 11:56:52  f20494a6ef686cb2b7420e967aab63d9
    File appears in 12 kits
newhotmail/Validation/login.php                     2250 2017-08-10 11:56:54  a79c23cd690f2634de5bf5c1f5dddd62
    File appears in 11 kits
newhotmail/Validation/login2.php                    3141 2017-08-10 11:56:56  40646ff90b588ed0ebd82e7cb4ba7355
    File appears in 12 kits
newhotmail/Validation/post.php                      1133 2017-09-28 10:22:02  4bb9ed0b29adc17bfa9bfd5611013f87

newhotmail/Validation/robots.txt                    1337 2017-08-10 11:56:56  ba613657ddd17df5e61d5571b9c9d681
    File appears in 134 kits
newhotmail/Validation/style.css                      937 2017-08-10 11:56:56  f5f2ae6487acbff6b334dc293cc9e16f
    File appears in 15 kits

2 Email addresses found:
    gp_support@geoplugin.com (appears in 1260 kits)
    fredrickdavies06@gmail.com



https://texasmalwareblog.blogspot.com   @phish_total